Forward-thinking organizations will recognize that consideration of the human-impact factor is fundamental to business continuity and disaster recovery planning. A highly-available IT infrastructure, having both systems and people that reside entirely within the potential impact zone of a single disaster, will not provide a company with the business resiliency necessary to maintain operations through a disaster.

Companies should ideally maintain the geographic separation of multiple data centers at a sufficient distance to ensure that at least one will survive any man-made event, such as an act of terrorism, or a natural disaster, such as an earthquake, a volcanic eruption, a hurricane, or flood. Companies should not only provide redundant systems but should also replicate data between the multiple sites. And while it has become increasingly popular to develop lights-out, secondary data centers, companies should give careful consideration to having multiple, fully-staffed operations centers. While a company may be able to recover applications to a remote, replicated site, if only a limited number of knowledgeable employees are stationed at the recovery location, and the workers within the disaster zone are managing their own, more personal disasters, the business may not be able to recover from an operational perspective. DR plans must allow for the real-life personal choices between business needs and personal and family needs that individual employees will make during a disaster and should expect that personal safety and family will come first. Therefore, disaster recovery and business continuity capabilities should not be "key-man" dependent. In addition, when the transportation system is disrupted, as happened to air travel within, to and from Western Europe during the recent volcanic eruption in Iceland, even if individuals are willing to go to another location to work, the residual effects of the disaster may prevent it.

As organizations take greater advantage of lower-cost human capital in developing regions in the deployment of data centers, they should also consider the quality of the physical infrastructure for both businesses and individuals. An earthquake in San Francisco, where building codes are well-established and rigorously enforced, will have substantially less human impact than an earthquake of similar magnitude in many developing countries. Even within developed countries, the impact of similar terrorist attacks may vary widely. In New York City, where building height and population density are both high, the impact of a terrorist, 9-11 style attack will be much greater than in London, where building heights and population density are more modest.

Action Item: CIOs should work with business and organizational executives to ensure that disaster recovery and business continuity plans consider the impact on both infrastructure and people. The recovery of IT systems is not the same as recovery of business operations. Regional differences in terms of disaster survivability are significant; employees will often put self and family before business, and disruptions in transportation systems can prevent employees from leaving the disaster zone, even when they are willing to do so. When possible, organizations should provide for distributed recovery scenarios with well-distributed workers, so that no single location and no single pool of human capital presents a single point of failure.